PostgreSQL Patches 52 Vulnerabilities, Including a Code Execution Flaw That Reportedly Dates Back Two Decades

PostgreSQL Security Alert: 52 Vulnerabilities Patched, Including a 22-Year-Old RCE Bug

November 13, 2026

The PostgreSQL Global Development Group released security updates on November 12, 2026: versions 18.7, 17.12, 16.16, 15.20 and 14.25. The batch fixes 52 vulnerabilities, and it is also the last release for PostgreSQL 14. Here is what administrators and developers need to know.

The headline flaw: CVE-2026-6460

CVE-2026-6460 is a type confusion bug in the core server with a CVSS score of 8.8 (High). According to the PostgreSQL advisory, a user who can create database objects can run arbitrary code as the operating system user that runs the database. The primary route is ALTER ... SET DATA TYPE, but the advisory notes other DDL sequences can trigger it too.

The underlying problem is that PostgreSQL did not adequately track the types of stored values, so stale values could surface in system catalog entries, PL/pgSQL variables and other places. Press coverage says the flaw traces back more than 20 years, and it affects every supported major version, 14 through 18. Attackers need a valid login with object-creation privileges. As of publication it is not known to be exploited, and the project says there is no workaround for servers that can’t be updated.

The rest of the batch

CVE-2026-6460 is one of many high-severity fixes. Others include CVE-2026-6467, where mishandling of extension script schemas can lead to arbitrary SQL execution (CVSS 7.2). Reporting on the release counts dozens of additional code-execution flaws, mostly memory-safety and type-confusion bugs. The release also fixes data-loss and crash-recovery problems, and a standby-server snapshot issue that could corrupt pg_dump output.

PostgreSQL 14 is end-of-life

Version 14.25 is the final release of the PostgreSQL 14 branch. It will get no further security or bug fixes. If you still run it, start planning your upgrade now.

What to do

Update your servers to 18.7, 17.12, 16.16, 15.20 or 14.25, matching your major version. Minor releases are cumulative, so no dump and reload is needed. Stop PostgreSQL, swap the binaries and restart.
Rebuild or update any custom C-language extensions at the same time as the server.
Update client tools such as psql and pg_dump on backup servers and admin workstations, since this release includes fixes affecting them.
Review who holds object-creation privileges, such as CREATE on schemas and databases. Those are the users who can reach the CVE-2026-6460 attack path.
Don’t turn off the new composite_type_mismatch checks. The project warns that disabling them carries security risk.
Plan your move off PostgreSQL 14 to a supported major version.